diff options
| -rw-r--r-- | playbook.yml | 54 | ||||
| -rw-r--r-- | tasks/email.yml | 54 | ||||
| -rw-r--r-- | tasks/network.yml | 39 | ||||
| -rw-r--r-- | tasks/zfs.yml | 18 | ||||
| -rw-r--r-- | templates/etc_aliases.j2 (renamed from templates/aliases.j2) | 0 | ||||
| -rw-r--r-- | templates/etc_dma_auth.conf.j2 (renamed from templates/auth.conf.j2) | 0 | ||||
| -rw-r--r-- | templates/etc_dma_dma.conf.j2 (renamed from templates/dma.conf.j2) | 0 | ||||
| -rw-r--r-- | templates/etc_ssh_sshd_config.j2 | 121 | ||||
| -rw-r--r-- | templates/usr_local_etc_rc.d_zpool_gpt_labels.j2 | 33 |
9 files changed, 272 insertions, 47 deletions
diff --git a/playbook.yml b/playbook.yml index 19ea687..45d45e1 100644 --- a/playbook.yml +++ b/playbook.yml @@ -1,5 +1,5 @@ --- -- name: Configure dma with generic SMTP on FreeBSD +- name: Configure my FreeBSD home server hosts: pursotin pre_tasks: @@ -21,51 +21,11 @@ dma_to_address: "{{ lookup('env', 'DMA_TO_ADDRESS') }}" tasks: - - name: Install dma - package: - name: dma - state: present + - name: Run network tasks + import_tasks: tasks/network.yml - - name: Create dma config directory - file: - path: /etc/dma - state: directory - owner: root - group: wheel - mode: "0755" + - name: Run email tasks + import_tasks: tasks/email.yml - - name: Configure dma.conf - template: - src: dma.conf.j2 - dest: /etc/dma/dma.conf - owner: root - group: wheel - mode: "0644" - - - name: Configure auth.conf - template: - src: auth.conf.j2 - dest: /etc/dma/auth.conf - owner: root - group: mail - mode: "0640" - - - name: Configure aliases - template: - src: aliases.j2 - dest: /etc/aliases - owner: root - group: wheel - mode: "0644" - - - name: Run newaliases - shell: newaliases - - - name: Test mail delivery - shell: echo "DMA test message from Ansible" | mail -s "Test DMA" root - register: mail_result - changed_when: false - - - name: Show mail result - debug: - var: mail_result + - name: Run ZFS tasks + import_tasks: tasks/zfs.yml diff --git a/tasks/email.yml b/tasks/email.yml new file mode 100644 index 0000000..fe83778 --- /dev/null +++ b/tasks/email.yml @@ -0,0 +1,54 @@ +- name: Install dma + package: + name: dma + state: present + +- name: Create dma config directory + file: + path: /etc/dma + state: directory + owner: root + group: wheel + mode: "0755" + +- name: Configure dma.conf + template: + src: etc_dma_dma.conf.j2 + dest: /etc/dma/dma.conf + owner: root + group: wheel + mode: "0644" + register: etc_dma_dma_conf + +- name: Configure auth.conf + template: + src: etc_dma_auth.conf.j2 + dest: /etc/dma/auth.conf + owner: root + group: mail + mode: "0640" + register: etc_dma_auth_conf + +- name: Configure aliases + template: + src: etc_aliases.j2 + dest: /etc/aliases + owner: root + group: wheel + mode: "0644" + register: etc_aliases_conf + +- name: Run newaliases + shell: newaliases + +- name: Test mail delivery + when: etc_dma_dma_conf.changed or etc_dma_auth_conf.changed or etc_aliases_conf.changed + block: + - name: Send email + shell: echo "DMA test message from Ansible" | mail -s "Test DMA" root + register: mail_result + changed_when: false + + - name: Show mail result + debug: + var: mail_result diff --git a/tasks/network.yml b/tasks/network.yml new file mode 100644 index 0000000..da194b9 --- /dev/null +++ b/tasks/network.yml @@ -0,0 +1,39 @@ +- name: Check existence of lan0 + shell: ifconfig lan0 || echo "failed" + register: lan0_status + +- name: Check existence of wan0 + shell: ifconfig wan0 || echo "failed" + register: wan0_status + +- name: Set up network interfaces + shell: | + sysrc -x ifconfig_igc0 + sysrc -x ifconfig_igc0_ipv6 + sysrc ifconfig_igc0_name="lan0" + sysrc ifconfig_igc1_name="wan0" + sysrc ifconfig_lan0="DHCP" + sysrc ifconfig_lan0_ipv6="inet6 accept_rtadv" + sysrc ifconfig_wan0="DHCP" + sysrc ifconfig_wan0_ipv6="inet6 accept_rtadv" + +- name: Restart networking if custom interfaces do not exist + shell: service netif restart + when: lan0_status.stdout.find('failed') != -1 or + wan0_status.stdout.find('failed') != -1 + +- name: Update facts + setup: + +- name: Set up sshd + template: + src: etc_ssh_sshd_config.j2 + dest: /etc/ssh/sshd_config + owner: root + group: wheel + mode: "0644" + register: etc_sshd_config + +- name: Restart sshd + shell: service sshd restart + when: etc_sshd_config.changed diff --git a/tasks/zfs.yml b/tasks/zfs.yml new file mode 100644 index 0000000..947ebb6 --- /dev/null +++ b/tasks/zfs.yml @@ -0,0 +1,18 @@ +- name: Ensure /usr/local/etc/rc.d/ exists + file: + path: /usr/local/etc/rc.d/ + state: directory + owner: root + group: wheel + mode: "0755" + +- name: Add zpool_gpt_labels rc.d service + template: + src: usr_local_etc_rc.d_zpool_gpt_labels.j2 + dest: /usr/local/etc/rc.d/zpool_gpt_labels + owner: root + group: wheel + mode: "0755" + +- name: Enable and start zpool_gpt_labels service + shell: service zpool_gpt_labels enable && service zpool_gpt_labels start diff --git a/templates/aliases.j2 b/templates/etc_aliases.j2 index a9ac845..a9ac845 100644 --- a/templates/aliases.j2 +++ b/templates/etc_aliases.j2 diff --git a/templates/auth.conf.j2 b/templates/etc_dma_auth.conf.j2 index a1000ea..a1000ea 100644 --- a/templates/auth.conf.j2 +++ b/templates/etc_dma_auth.conf.j2 diff --git a/templates/dma.conf.j2 b/templates/etc_dma_dma.conf.j2 index dfaa04f..dfaa04f 100644 --- a/templates/dma.conf.j2 +++ b/templates/etc_dma_dma.conf.j2 diff --git a/templates/etc_ssh_sshd_config.j2 b/templates/etc_ssh_sshd_config.j2 new file mode 100644 index 0000000..b7ad162 --- /dev/null +++ b/templates/etc_ssh_sshd_config.j2 @@ -0,0 +1,121 @@ +# $OpenBSD: sshd_config,v 1.104 2021/07/02 05:11:21 dtucker Exp $ + +# This is the sshd server system-wide configuration file. See +# sshd_config(5) for more information. + +# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin + +# The strategy used for options in the default sshd_config shipped with +# OpenSSH is to specify options with their default value where +# possible, but leave them commented. Uncommented options override the +# default value. + +# Note that some of FreeBSD's defaults differ from OpenBSD's, and +# FreeBSD has a few additional options. + +#Port 22 +#AddressFamily any +#ListenAddress 0.0.0.0 +#ListenAddress :: + +#HostKey /etc/ssh/ssh_host_rsa_key +#HostKey /etc/ssh/ssh_host_ecdsa_key +#HostKey /etc/ssh/ssh_host_ed25519_key + +# Ciphers and keying +#RekeyLimit default none + +# Logging +#SyslogFacility AUTH +#LogLevel INFO + +# Authentication: + +#LoginGraceTime 2m +PermitRootLogin prohibit-password +#StrictModes yes +#MaxAuthTries 6 +#MaxSessions 10 + +#PubkeyAuthentication yes + +# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2 +# but this is overridden so installations will only check .ssh/authorized_keys +AuthorizedKeysFile .ssh/authorized_keys + +#AuthorizedPrincipalsFile none + +#AuthorizedKeysCommand none +#AuthorizedKeysCommandUser nobody + +# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts +#HostbasedAuthentication no +# Change to yes if you don't trust ~/.ssh/known_hosts for +# HostbasedAuthentication +#IgnoreUserKnownHosts no +# Don't read the user's ~/.rhosts and ~/.shosts files +#IgnoreRhosts yes + +# Change to yes to enable built-in password authentication. +# Note that passwords may also be accepted via KbdInteractiveAuthentication. +PasswordAuthentication yes +#PermitEmptyPasswords no + +# Change to no to disable PAM authentication +#KbdInteractiveAuthentication yes + +# Kerberos options +#KerberosAuthentication no +#KerberosOrLocalPasswd yes +#KerberosTicketCleanup yes +#KerberosGetAFSToken no + +# GSSAPI options +#GSSAPIAuthentication no +#GSSAPICleanupCredentials yes + +# Set this to 'no' to disable PAM authentication, account processing, +# and session processing. If this is enabled, PAM authentication will +# be allowed through the KbdInteractiveAuthentication and +# PasswordAuthentication. Depending on your PAM configuration, +# PAM authentication via KbdInteractiveAuthentication may bypass +# the setting of "PermitRootLogin prohibit-password". +# If you just want the PAM account and session checks to run without +# PAM authentication, then enable this but set PasswordAuthentication +# and KbdInteractiveAuthentication to 'no'. +#UsePAM yes + +#AllowAgentForwarding yes +#AllowTcpForwarding yes +#GatewayPorts no +#X11Forwarding no +#X11DisplayOffset 10 +#X11UseLocalhost yes +#PermitTTY yes +#PrintMotd yes +#PrintLastLog yes +#TCPKeepAlive yes +#PermitUserEnvironment no +#Compression delayed +#ClientAliveInterval 0 +#ClientAliveCountMax 3 +#UseDNS yes +#PidFile /var/run/sshd.pid +#MaxStartups 10:30:100 +#PermitTunnel no +#ChrootDirectory none +#UseBlacklist no +#VersionAddendum FreeBSD-20250219 + +# no default banner path +#Banner none + +# override default of no subsystems +Subsystem sftp /usr/libexec/sftp-server + +# Example of overriding settings on a per-user basis +#Match User anoncvs +# X11Forwarding no +# AllowTcpForwarding no +# PermitTTY no +# ForceCommand cvs server diff --git a/templates/usr_local_etc_rc.d_zpool_gpt_labels.j2 b/templates/usr_local_etc_rc.d_zpool_gpt_labels.j2 new file mode 100644 index 0000000..36bc715 --- /dev/null +++ b/templates/usr_local_etc_rc.d_zpool_gpt_labels.j2 @@ -0,0 +1,33 @@ +#!/bin/sh + +# PROVIDE: zpool_gpt_labels +# REQUIRE: zfs +# BEFORE: LOGIN +# KEYWORD: nojail + +. /etc/rc.subr + +name="zpool_gpt_labels" +rcvar="zpool_gpt_labels_enable" +start_cmd="zpool_gpt_labels_start" + +zpool_gpt_labels_start() { + logger "Setting zpool vdev paths to GPT labels" + local zpool_status="$(zpool status)" + for i in 0 1 2 3; do + local raw="nda${i}p4.eli" + local path="/dev/gpt/zfs${i}.eli" + case "$zpool_status" in + *"$raw"*) + zpool set "path=${path}" zroot "${raw}" + logger "Setting ${raw} -> ${path}" + ;; + *) + logger "Skipping ${raw}..." + ;; + esac + done +} + +load_rc_config $name +run_rc_command "$1" |